5 ms·

Considering how few developers understand the subtleties of security, it would not be all that difficult. Also, FWIW we know that Google did this with its data

Considering how few developers understand the subtleties of security, it would not be all that difficult. Also, FWIW we know that Google did this with its data center breach and likely many other cases. At WhatsApp/Google scale the attack is extremely cost effective.

ghostpepper 7y ago
Can you elaborate on the google data center breach? Are you saying it was orchestrated by google?
- resters 7y ago
  Not orchestrated, but happily tolerated. All Google needs is to be able to plausibly deny complicity, but the other practices of Google (such as not offering warrant canaries on all Google accounts) indicate that Google is eager to cooperate and please governments, so it would have been easy to leave a few doors unlocked, hire a plant (with solid itsec skills), etc.
  - ghostpepper 7y ago
    Was this reported in the news? Why did I not hear about it?
    - ta999999171 7y ago
      Snark for your snark: you don't read enough in the right places?
  - nostrademons 7y ago
    I was at Google at the time of the Snowden disclosures. People there were furious, and encrypting internal traffic became a top priority immediately afterwards.
    - resters 7y ago
      Of course. That is the correct response once the attack is known. To most people, unencrypted traffic vs encrypted traffic seems like an obvious security oversight, but many others exist that are not so stark and obvious sounding. My point is that all indications point to Google being unbelievably cooperative with the US Government, essentially allowing whatever legal or extralegal (per Snowden) back doors were requested. It is not much of a leap to conclude that Google was both aware and cooperative with the harvesting of unencrypted traffic. This does not mean that all employees were aware of it. The analysis should be to discover how few employees would have had to be complicit for the attack to be carried out successfully. There is no way that such an attack would succeed if too many were aware, since it is obviously in the extralegal (Snowden revelation) category, and since most Google employees are ethical humans, it would have provoked outrage if widely known.
deleted 7y ago
[deleted]
aodin 7y ago
Are you referring to the data center breaches exposed by the Snowden leaks? Because Google claimed that they were unaware of the breach and quickly took action to correct it [1]. Are you suggesting that Google was complicit? [1] https://www.zdnet.com/article/meet-muscular-nsa-accused-of-tapping-links-between-yahoo-google-datacenters/ https://www.zdnet.com/article/meet-muscular-nsa-accused-of-t...
- resters 7y ago
  I don't think Google has given us any reason to believe that it was not complicit. For instance, why not include warrant canaries on gmail accounts? There is not really any fundamental difference between abetting the data center breach and opting not to offer warrant canaries. Likely tens of thousands of Google users are searched every day due to easy FISC warrants and wide investigative nets. The state sponsored attacks on Google would of course allow Google to plausibly deny cooperation, but obviously Google has every incentive to cooperate fully, as is evidenced by the lack of warrant canaries.
  - iudqnolq 7y ago
    Warrant cannaries are of dubious legality and have yet to be seriously tested in court. It makes total sense that a large company would not adopt something potentially illegal. A person on StackExchange put it well > The distinction between revealing the existence of the subpoena by action, rather than by inaction, is a false one. It's exactly the kind of cutesy legal formality that non-lawyers love to rely on, but real judges ignore. If you tell someone: "Hey, you know John Smith's three sons, Joe, Ted, and Bill? Joe and Ted are good people; they have never molested any children. As for Bill--well, I don't have anything to say about Bill." If Bill is not a child molester, you have defamed him, and you are not going to convince a judge otherwise. [1] Here's how the EFF puts it. > Are there any cases upholding warrant canaries? > Not yet. EFF believes that warrant canaries are legal, and the government should not be able to compel a lie. To borrow a phrase from Winston Churchill, no one can guarantee success in litigation, but only deserve it. I'm also not sure how warrant canaries relate to your parents' point. [1]: https://law.stackexchange.com/a/333 https://law.stackexchange.com/a/333

ghostpepper 7y ago

Can you elaborate on the google data center breach? Are you saying it was orchestrated by google?

resters 7y ago
Not orchestrated, but happily tolerated. All Google needs is to be able to plausibly deny complicity, but the other practices of Google (such as not offering warrant canaries on all Google accounts) indicate that Google is eager to cooperate and please governments, so it would have been easy to leave a few doors unlocked, hire a plant (with solid itsec skills), etc.
- ghostpepper 7y ago
  Was this reported in the news? Why did I not hear about it?
  - ta999999171 7y ago
    Snark for your snark: you don't read enough in the right places?
- nostrademons 7y ago
  I was at Google at the time of the Snowden disclosures. People there were furious, and encrypting internal traffic became a top priority immediately afterwards.
  - resters 7y ago
    Of course. That is the correct response once the attack is known. To most people, unencrypted traffic vs encrypted traffic seems like an obvious security oversight, but many others exist that are not so stark and obvious sounding. My point is that all indications point to Google being unbelievably cooperative with the US Government, essentially allowing whatever legal or extralegal (per Snowden) back doors were requested. It is not much of a leap to conclude that Google was both aware and cooperative with the harvesting of unencrypted traffic. This does not mean that all employees were aware of it. The analysis should be to discover how few employees would have had to be complicit for the attack to be carried out successfully. There is no way that such an attack would succeed if too many were aware, since it is obviously in the extralegal (Snowden revelation) category, and since most Google employees are ethical humans, it would have provoked outrage if widely known.

deleted 7y ago

[deleted]

aodin 7y ago

Are you referring to the data center breaches exposed by the Snowden leaks? Because Google claimed that they were unaware of the breach and quickly took action to correct it [1]. Are you suggesting that Google was complicit? [1] https://www.zdnet.com/article/meet-muscular-nsa-accused-of-tapping-links-between-yahoo-google-datacenters/ https://www.zdnet.com/article/meet-muscular-nsa-accused-of-t...

resters 7y ago
I don't think Google has given us any reason to believe that it was not complicit. For instance, why not include warrant canaries on gmail accounts? There is not really any fundamental difference between abetting the data center breach and opting not to offer warrant canaries. Likely tens of thousands of Google users are searched every day due to easy FISC warrants and wide investigative nets. The state sponsored attacks on Google would of course allow Google to plausibly deny cooperation, but obviously Google has every incentive to cooperate fully, as is evidenced by the lack of warrant canaries.
- iudqnolq 7y ago
  Warrant cannaries are of dubious legality and have yet to be seriously tested in court. It makes total sense that a large company would not adopt something potentially illegal. A person on StackExchange put it well > The distinction between revealing the existence of the subpoena by action, rather than by inaction, is a false one. It's exactly the kind of cutesy legal formality that non-lawyers love to rely on, but real judges ignore. If you tell someone: "Hey, you know John Smith's three sons, Joe, Ted, and Bill? Joe and Ted are good people; they have never molested any children. As for Bill--well, I don't have anything to say about Bill." If Bill is not a child molester, you have defamed him, and you are not going to convince a judge otherwise. [1] Here's how the EFF puts it. > Are there any cases upholding warrant canaries? > Not yet. EFF believes that warrant canaries are legal, and the government should not be able to compel a lie. To borrow a phrase from Winston Churchill, no one can guarantee success in litigation, but only deserve it. I'm also not sure how warrant canaries relate to your parents' point. [1]: https://law.stackexchange.com/a/333 https://law.stackexchange.com/a/333